What happened
On October 29, 2026, Ivanti released an update to their security advisory for Ivanti Connect Secure (ICS) to address two newly discovered vulnerabilities, along with providing fixes for both. These vulnerabilities, CVE-2026-111357 and CVE-2026-118527, were exploited in the wild before the details were publicly disclosed. CVE-2026-111357 involves a missing authentication for a critical function, allowing an authenticated local attacker to escalate privileges. CVE-2026-118527 allows an authenticated remote attacker to upload attacker-controlled content to a known location on disk. Exploitation was observed prior to disclosure, particularly when chained with CVE-2026-104935, an authentication bypass vulnerability initially reported by Rapid7. All three vulnerabilities are now patched by Ivanti, and fixes are publicly available. CVE-2026-104935, with a CVSS score of 8.6, remains relevant as the initial point of compromise.
Who is affected
Organisations running affected deployments of Ivanti Connect Secure are advised that these vulnerabilities have been exploited in the wild, posing significant privilege escalation and remote access risks. The vulnerabilities impact systems where the flaws are present and are actively being exploited, increasing the urgency of applying updates. No specific environment details are known, but any affected deployment that has not yet received the latest fixes may still be vulnerable to exploitation.
Recommended actions
- Apply the available fixes provided by Ivanti to address CVE-2026-111357, CVE-2026-118527, and CVE-2026-104935.
- Review and update vulnerable systems promptly to prevent ongoing exploitation opportunities.
